YubiHSM 2 v2.4

What this device is for

YubiHSM 2 is a USB-based HSM for companies where cryptographic keys cannot simply be stored on a server: PKI, certificate authorities, certificate signing, code signing, service encryption. It is purchased to avoid relying solely on software and OS-level permissions. The device acts as a hardware root of trust for signing and encryption operations within infrastructure.

Isolated cryptographic keys

Cryptographic keys can be generated, imported, and stored directly inside the YubiHSM 2, and all operations are executed within the device. This reduces the risk of key theft both during server attacks (malware, vulnerability exploitation) and in case of physical server compromise. The server receives only the result of the operation (signature/encryption), not the key material itself.

Cryptography that prod relies on

YubiHSM 2 supports operations required in enterprise scenarios: hashing, key wrapping, asymmetric signing and decryption, including advanced signing scenarios with ed25519. It also supports attestation for asymmetric key pairs generated on the device.

Access control by roles and domains

Inside the device there are security domains: keys and objects belong to domains, and permissions are assigned per authentication key — you can define “who signs”, “who administers”, and “who reads audit logs”.
Additionally, there is a tamper-evident audit log: event logs can be exported for monitoring and reporting, making any changes visible.

Integrations and connectivity

YubiHSM 2 is designed for large infrastructures: up to 16 concurrent connections, with options to make the HSM accessible to multiple systems (including virtual machines). Integration is built through standard interfaces: PKCS#11, YubiHSM KSP for Microsoft CNG, as well as native libraries for Windows/Linux/macOS. All of this works without custom workarounds.

Crypto Library Update

In firmware v2.4, the cryptographic library for RSA and ECC operations (including signing and decryption) has been updated. This is Yubico’s internal implementation, the same library used in the YubiKey 5.7 release.

Backup and key transfer using M-of-N rule

YubiHSM 2 supports an M-of-N rule for wrap keys: restoring a key on another HSM requires participation from multiple administrators (a quorum), not just a single backup owner.

Audit Logging

YubiHSM 2 maintains an internal log of administrative and operational events. The log can be exported for monitoring and reporting, and entries are linked via a hash chain, making any attempt to alter or delete records detectable.

Nano form factor + what’s new in v2.4

The Nano form factor is a truly compact HSM that fits neatly into a USB-A port without interfering in a server setup.
New in v2.4:

• Asymmetric backups — a secure and practical way to create backups using asymmetric encryption, including transfer over the internet

• BYOK (Bring Your Own Key) — for cloud usage scenarios, allowing storage and management of your own keys in multi-cloud environments with a focus on control and compliance

Secure session

When working with YubiHSM 2, communication between the application and the device is performed via a secure session with mutual authentication. This reduces the risk of interception or tampering with commands and responses, especially when the HSM is used in production and accessed automatically by services.

Additional benefit for administrators

For administering YubiHSM 2, you can use a YubiKey with the YubiHSM Auth application: the key stores the data required to establish a secure session with the HSM. This ensures that secrets are not stored in server configs or scripts — access is tied to a physical YubiKey belonging to a specific administrator.

Where YubiHSM 2 is used

YubiHSM 2 is typically chosen for scenarios where impotrant hardware protection of cryptographic keys and secure execution of critical operations are required. Most often it is used for the protection of key infrastructure PKI/CA, integration with systems via PKCS#11 and other standard interfaces, working with Microsoft AD CS, enhancing security in cryptocurrency exchanges and fintech-services, and also for the protection of keys in IoT-infrastructure and related with it’s devices